Smart Popup by Supsystic <= 2.0.0 - Authenticated (Administrator+) Remote Code Execution via Server-Side Template Injection in Popup Content
- ID
- WPSEC-2026-1521
- Plugin
- Customer Engagement System – Popup Builder, Forms, CRM & Email Marketing Automation (popup-by-supsystic)
- Affected
- all versions before 2.0.2
- Remediation
- Update to 2.0.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-1336
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-23
- Attack surface
- Smart Popup by Supsystic on WPSec AttackSurface
- Fix released
- Published
Description
The Popup Builder, Forms, CRM & Email Marketing Automation plugin for WordPress is vulnerable to Server-Side Template Injection via popup text values and [if]/[elseif] template conditions in all versions up to, and including, 2.0.0. This is due to popup content being rendered by an unsandboxed Twig environment, with condition expressions written directly into Twig tags and Twig delimiters in popup values left unescaped. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary Twig expressions and execute code on the server, which crosses a boundary in environments where administrators cannot otherwise run code, such as multisite or installations with file modifications disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1521/
- https://plugins.svn.wordpress.org/popup-by-supsystic/tags/2.0.2/
- https://wordpress.org/plugins/popup-by-supsystic/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS